Enterprise Build Of Quarkus
Monthly
SQL injection in IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1 allows remote unauthenticated attackers to view, add, modify, or delete back-end database information. The flaw (CWE-89) carries a CVSS 3.1 base score of 8.6, with an independent assessment vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, indicating high confidentiality and integrity impact and low availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but a vendor patch is available via IBM support.
Denial of service in IBM Enterprise Build of Quarkus (versions 3.27.1 through 3.27.4.SP2 and 3.33.1 through 3.33.2.SP2) allows a remote, unauthenticated attacker to exhaust memory by sending multipart requests whose MIME part-headers are accumulated without bound in the Quarkus REST layer. Because each part-header buffer grows without a size cap, an attacker can force excessive heap allocation and crash or hang the service, degrading availability for all users. There is no public exploit identified at time of analysis, but the flaw is trivially reachable (AV:N/AC:L/PR:N/UI:N) against any endpoint that accepts multipart input.
SQL injection in IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1 allows remote unauthenticated attackers to view, add, modify, or delete back-end database information. The flaw (CWE-89) carries a CVSS 3.1 base score of 8.6, with an independent assessment vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, indicating high confidentiality and integrity impact and low availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but a vendor patch is available via IBM support.
Denial of service in IBM Enterprise Build of Quarkus (versions 3.27.1 through 3.27.4.SP2 and 3.33.1 through 3.33.2.SP2) allows a remote, unauthenticated attacker to exhaust memory by sending multipart requests whose MIME part-headers are accumulated without bound in the Quarkus REST layer. Because each part-header buffer grows without a size cap, an attacker can force excessive heap allocation and crash or hang the service, degrading availability for all users. There is no public exploit identified at time of analysis, but the flaw is trivially reachable (AV:N/AC:L/PR:N/UI:N) against any endpoint that accepts multipart input.